Appendix A: how we use your information

ConnectedCare / Thames Valley and Surrey (TVS) Care RecordsPurpose: Some of the services PCA is commissioned to deliver work proactively: we identify people who may benefit from a review and invite them, rather than waiting for a referral to be made. These services are delivered in partnership with local GP practices and, where relevant, with NHS trusts.To do this we use the case-finding tool within ConnectedCare, part of the Thames Valley and Surrey (TVS) Care Records. This searches information already shared into the TVS Care Records by GP practices and other providers, and produces a list of patients who meet the clinical criteria for the service concerned. The criteria are set for each service and relate only to the condition that service exists to treat.We then export from ConnectedCare the identifiers, contact details and relevant clinical information for the patients concerned, and transfer them into PCA's own clinical record systems, so that we can contact those patients and provide their care.Patients whose records show that they have elected not to be contacted by SMS are excluded from the export.Basis for our access: PCA has signed the Regional Health and Social Care Information Sharing Agreement (the 'Regional ISA') as an independent-sector healthcare provider, and meets the qualifying standard set out in it. This enables PCA to process data for the TVS / ConnectedCare use cases for the practices and patients within Berkshire West, and for patients from outside Berkshire West who are referred to, or present to, PCA.Controller: GP practices and other source organisations remain the controllers of the records they contribute to the TVS Care Records. From the point at which PCA exports data from ConnectedCare, PCA becomes the sole controller of the exported data and is responsible for its safekeeping and use.Type of data: Identifiable.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Common law duty of confidentiality: implied consent for the purposes of your direct care. Contacting patients about the service is within the use case defined under the Regional ISA.Your choices: This activity is part of your individual care, so the National Data Opt-Out does not apply to it. You do not have to accept an invitation, and you can tell us at any time that you do not wish to be contacted about a service.Data protection impact assessments: The TVS / ConnectedCare processing is covered by DPIA2030, published at regisa.uk. PCA's processing within its own clinical record system is covered by PCA's DPIA for that system. The export, transfer and upload from ConnectedCare into PCA's clinical record system is separately assessed by PCA.Processor: Graphnet Health (Thames Valley and Surrey Care Records / ConnectedCare); Medicus and EMIS; Accurx

Thames Valley and Surrey (TVS) Care Records · ConnectedCarePurpose: Health and care services across Thames Valley and Surrey share information through a shared care record, known locally as ConnectedCare. It is important for anyone treating you to be able to see your shared record so that they have the information they need to care for you, both during routine appointments and in urgent situations such as attending A&E, calling 111, or an out-of-hours appointment. It is also quicker for staff to view a shared record than to contact other staff by telephone or email.Only authorised staff can access the record, and what they can see is controlled according to their role and the service they work in. The systems do not share all of your data, only the data which the participating services have agreed is necessary.Each organisation keeps its own records and allows other organisations to view them. Under the NHS Records Management Code of Practice this is an integrated record of the viewing type, and each organisation retains its own records for the period that applies to its own service.PCA clinicians use the shared care record to inform the care they give you.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018 Your choices: You have the right to object to your information being shared through the TVS Care Records. If you wish to do so, you should speak to your GP practice and to the other organisations involved in your care, and understand what it would mean for you. An objection will mean your data is not available for any kind of direct care, including in an emergency.Processor: Graphnet Health (Thames Valley and Surrey Care Records / ConnectedCare)

Viewing your GP practice recordPurpose: PCA clinicians view the record held by your registered GP practice through GP Connect, a national service operated by NHS England, so that clinical decisions are made against your current primary care record. Access is read-only and in real time. GP Connect is used only for direct care. It is not used for case finding, planning, reporting or research.What is withheld: Items your GP practice has marked as not for sharing are not released, and the Royal College of General Practitioners' sensitive dataset is excluded. Where your practice has recorded that you do not wish your record to be shared, that setting is applied by their system and cannot be overridden by us.Basis for our access: PCA is assured as a consuming organisation under NHS England's GP Connect onboarding process, connects over the Health and Social Care Network, and maintains compliance with the NHS Data Security and Protection Toolkit. Permission to view is obtained from you by the clinician or team at the point of contact. Each access is recorded in an audit log.Controller: Your GP practice remains the controller of your GP record. NHS England is the controller for the operation of the GP Connect service and for the message audit data held on Spine; it does not retain the content of your record. Where our clinician records information from your GP record into our own clinical record, PCA is the controller of that copy.Type of data: Identifiable.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018.Common law duty of confidentiality: implied consent for the purposes of your direct care.Your choices: This is part of your individual care, so the National Data Opt-Out does not apply. If you do not wish your GP record to be viewed in this way, speak to your GP practice, who can record that on their system. Please be aware that this would apply wherever you present for care, not only to PCA.Processor: NHS England (GP Connect); Medicus; EMIS

NHS Trusts · Community providers · Pharmacies · Care and nursing homes · Other care providersPurpose: Personal information is shared with GP practices, secondary care trusts and other providers in order to provide you with individual direct care services. This includes sharing the outcome of your PCA consultation with your registered GP practice, and with the hospital service that referred you where applicable.Legal basis: The processing of personal data in the delivery of direct care, and for providers' administrative purposes in support of direct care, is supported under the following:Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Processor: Royal Berkshire NHS Foundation Trust; Berkshire Healthcare NHS Foundation Trust; registered GP practices

Purpose: Following a consultation with PCA, we write to your registered GP practice with the outcome, any change to your medication, and any monitoring we have asked them to carry out. Relevant results and clinical codes are also added to your primary care record so that your GP practice holds a complete and up-to-date record without having to chase us for it.Where your practice is able to receive it, we send this directly into their workflow using GP Connect or MESH, a national NHS England service, rather than by email or post. The document arrives in your practice's incoming queue for a member of their team to review and file into your record. Once it is delivered, your GP practice is the controller of that copy.Where care is handed back to your GP practice at the end of the programme, we provide a structured handover summarising your current treatment, your most recent results, and when your next monitoring is due.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Processor: Registered GP practices and their clinical system suppliers; NHS England (GP Connect)

Blood test requests and results · BSPS · RBFT ICEPurpose: We request blood tests directly and receive the results, so that your treatment can be reviewed and monitored safely without your GP practice having to generate the request separately. Your identifiers and the clinical reason for the test are shared with the laboratory service.Results are reviewed by a PCA prescriber, acted on, and made available to your GP practice.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Processor: Berkshire and Surrey Pathology Services (BSPS); Royal Berkshire NHS Foundation Trust (ICE)

Electronic Prescription Service (EPS)Purpose: Where a PCA prescriber issues you with a prescription, your personal information is processed in order to produce, transmit and dispense it. Prescriptions are transmitted electronically to the pharmacy you nominate through the Electronic Prescription Service.Information about medicines prescribed is also shared with your GP practice so that your repeat medication list can be kept accurate.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Prescription data is also processed by the NHS Business Services Authority for reimbursement and prescribing analysis purposes.Processor: NHS England (EPS); NHS Business Services Authority; your nominated pharmacy; Thames Valley ICB

SMS · NHS AppPurpose: Personal identifiable information is shared with our messaging service in order that messages can be sent to you safely. These include invitations to book an appointment, appointment reminders, requests to attend for a blood test, results notifications, and messages relating to your treatment.These messages form part of your care. They are not marketing, and your contact details are not used to promote products or services.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Under the Privacy and Electronic Communications (EC Directive) Regulations 2003 these are service communications rather than direct marketing, so prior consent is not required to send them.Messages are sent by PCA from our own systems, and we are the controller of the information used to send them.We keep clinical detail out of text messages. We cannot be certain that only you will see a message on your phone, so an invitation will tell you that we would like to offer you a review and how to contact us, and the clinical detail is discussed with you in your appointment.Your choices: If you do not wish to receive text messages from us, please contact us. We will record your preference and contact you another way.Processor: Accurx and Medicus; Twilio; NHS England (NHS App messaging), where used

Telephone · Video consultation · Clinical photographyPurpose: PCA delivers most of its clinical care remotely. Personal information, and in some cases images, may be processed, stored and, with your consent, shared in order to provide you with clinical assessment and advice.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018You may be asked to provide photographs, with your consent. There are restrictions on what we can accept: no photographs of the full face, no intimate areas, no images of patients who cannot consent to the process, and no identifiable images of children.Processor: Medicus; Accurx

Purpose: We work with other health and social care organisations to provide safe, coordinated care. Where necessary for your direct care, relevant information may be shared and viewed through the Thames Valley & Surrey (TVS) Care Records and during Integrated Care Team (ICT) and Multi-Disciplinary Team (MDT) discussions. This enables professionals involved in your care to assess needs, plan treatment, coordinate services and record agreed care decisions. Legal Basis: Article 6(1)e“processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”;Article 9(2)h“processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services”;Where applicable, Articles 9(2)(g) and 9(2)(i) may also apply.The processing is supported by the Health and Social Care Act 2012 and other relevant health and care legislation.Processor/Joint Controller: For MDT and integrated care decisions recorded directly in the TVS Care Records, participating organisations act as Joint Controllers, with Frimley Health NHS Foundation Trust acting as the Lead Controller for this processing.Each organisation remains responsible for the information it holds within its own clinical or care record systems.The TVS Care Records service is supported by contracted data processors, including Graphnet, Microsoft, and EMIS (where applicable), who process information on behalf of participating organisations under appropriate contractual and security arrangements.

e-Referral Service · Social prescribing · Public health servicesPurpose: Where your assessment indicates that you would benefit from another service, for example a hospital specialist clinic, a stop-smoking service, a physical activity or weight management programme, or a social prescriber, we share the information necessary to make that referral.Only patients who wish to use these services will have their data shared with them.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Where a referral is made at your request to a service you have chosen, we will seek your agreement first.Processor: NHS England (e-Referral Service); Royal Berkshire Hospital; Berkshire Healthcare NHS Foundation Trust; Reading Borough Council; Wokingham Borough Council; West Berkshire Council

Purpose: 'Risk stratification for case finding' is a process for identifying and managing patients who have, or may be at risk of, health conditions, or who are most likely to need healthcare services. Risk stratification tools used in the NHS help determine a person's risk of a particular condition and enable us to focus on preventing ill health before it develops.Information about you is collected from a number of sources including NHS Trusts, GP federations and your GP practice. This can help us identify and offer you additional services to improve your health.If you do not wish information about you to be included in any risk stratification programmes, please let your GP practice know. A code can be added to your records that will stop your information from being used for this purpose. Please be aware that this may limit the ability of healthcare professionals to identify if you have, or are at risk of developing, certain serious health conditions.Type of data: Identifiable / pseudonymised / anonymised / aggregate dataLegal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Processor: Graphnet Health; Thames Valley and Surrey Care Records

Purpose: Population health management aims to shift the focus from reactive care to proactive, preventative care. Health and care services work together as an Integrated Care System and share data in order to:Understand the health and care needs of the population, including health inequalitiesProvide support where it will have the most impactIdentify early actions to keep people well, not only focusing on people in direct contact with services but looking to join up care across different partnersType of data: Identifiable / pseudonymised / anonymised / aggregate data. Only organisations that provide your care will see your identifiable data.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Your choices: The National Data Opt-Out applies where confidential patient information is used for purposes beyond individual care.Processor: Graphnet Health; Thames Valley and Surrey Care Records

Planning · Quality and performancePurpose: Anonymous and aggregated data is used by the Integrated Care Board and by the organisations that commission our services for planning, performance and commissioning purposes, as required by our contracts.This includes reporting on how many patients have been contacted, seen, treated and returned to their GP practice, and on the clinical outcomes achieved. This reporting does not identify individual patients.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Your choices: You may opt out of your personal confidential data being used for planning or research. Contact your GP practice to apply a Type 1 Opt Out, or visit nhs.uk/your-nhs-data-matters to apply a National Data Opt-Out.Processor: NHS Thames Valley Integrated Care Board; Royal Berkshire NHS Foundation Trust

Purpose: We will share personal confidential information with the safeguarding team where there is a need to assess and evaluate any safeguarding concerns and to protect the safety of individuals.Consent is not required to share information for this purpose.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Processor: Reading Borough Council; Wokingham Borough Council; West Berkshire Council

Purpose: We will share children's personal information where there is a need to assess and evaluate any safeguarding concerns and to protect the safety of children.Consent may not be required to share this information.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018 Processor: Reading Borough Council; Wokingham Borough Council; West Berkshire Council

Purpose: The CQC is the regulator for health and social care services in England, and ensures that safe care is provided. The CQC inspects and produces reports on registered providers, including PCA. The law allows the CQC to access identifiable data.The CQC privacy statement is available at cqc.org.uk.Legal basis: Article 6(1)(c) '...processing is necessary for compliance with a legal obligation'; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Processor: Care Quality Commission

Purpose: We review a sample of consultations to check the quality and safety of the care we provide, to support our clinicians through supervision, and to train staff. Wherever possible this is done using de-identified information. Where a clinician needs to see the full record, for example a supervising prescriber reviewing a consultation, access is limited to the staff who need it.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Article 9(2)(h) also covers the management of health care systems and services.Processor: None. This is carried out within PCA.

Purpose: We review a sample of consultations to check the quality and safety of the care we provide, to support our clinicians through supervision, and to train staff. Wherever possible this is done using de-identified information. Where a clinician needs to see the full record, for example a supervising prescriber reviewing a consultation, access is limited to the staff who need it.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Article 9(2)(h) also covers the management of health care systems and services.Processor: None. This is carried out within PCA.

Purpose: We work with Health Innovation Oxford and Thames Valley (HIOTV) on service improvement and innovation. The information we share for this purpose is anonymised or aggregated. It does not identify you, and we do not share personal identifiable information with HIOTV.Where personal confidential data is shared, your consent will be required.Where you have opted out of your information being shared for planning or research, your information will not be shared.Legal basis: Articles 6(1)(a) and 9(2)(a): explicit consent; orArticle 6(1)(e) together with Article 9(2)(j) (scientific research)Where identifiable data is required for research, patient consent will be needed, unless there is a legitimate reason under law to do so or there is support under the Health Service (Control of Patient Information) Regulations 2002 ('section 251 support') applying via the Confidentiality Advisory Group.Processor: Health Innovation Oxford and Thames Valley (HIOTV)

Purpose: Your record may be requested by you, or by a third party acting on your behalf with your written authority. We will only release the information that has been asked for and that we are permitted to release.We hold only the records relating to care provided by PCA. Requests for your full GP record should be made to your GP practice.Legal basis: Articles 6(1)(a) and 9(2)(a): explicit consent, where a third party is acting on your behalf; orArticle 6(1)(c) and Article 9(2)(h), where we are required to respond under Data Protection Legislation Processor: None

Purpose: Personal confidential information may be shared with the police where there is a legal requirement to do so, or where we have assessed that the public interest in sharing outweighs the public interest in maintaining confidentiality, for example to support the prevention or detection of serious crime. Each request is considered individually and only the minimum necessary information is disclosed.Legal basis: Article 6(1)(c) '...processing is necessary for compliance with a legal obligation'; andArticle 9(2)(g): substantial public interest; or Article 9(2)(c): vital interestsProcessor: Thames Valley Police; other police forces as required

Purpose: Records or extracts of records relating to deceased patients may be requested by a Coroner or a Medical Examiner. Records associated with deceased patients are outside the scope of the UK GDPR, although the common law duty of confidentiality continues to apply. Where a third party's details are included, those details are within the scope of the UK GDPR.Legal basis: Coroners and Justice Act 2009; Access to Health Records Act 1990Processor: Berkshire Coroner's Office; Royal Berkshire NHS Foundation Trust Medical Examiner Service

Purpose: PCA holds your clinical record in an electronic patient record system provided under contract. The supplier processes your information only on our written instruction, under a contract which meets the requirements of Article 28 UK GDPR, and completes the NHS Data Security and Protection Toolkit.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Processor: Medicus; EMIS

Purpose: PCA uses an internet-based telephone system to make and receive calls with patients. The system is used to manage call volume and to support consultations delivered by telephone.Calls to and from the service are recorded. You will be told at the start of the call. Recordings are used to support the safety and quality of your care, to confirm what was discussed and agreed if there is a later query or complaint, for clinical supervision and training, and to investigate incidents. Access is limited to staff who need it for those purposes, and each access is logged.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018How long we keep recordings: Recordings are kept for six years from the date of the call, in line with the NHS Records Management Code of Practice and the Limitation Act 1980. Where clinical information from a call cannot be written into your record, the recording is treated as part of your health record and kept for the same period as that record. Call logs and related system records are kept for at least one year.Processor: X-on Health (Surgery Connect)

Purpose: Where you need an interpreter or translated information in order to take part in a consultation, we share the information necessary for that service to be provided.If you need an interpreter, please tell us when you book and we will arrange one for your appointment.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018 Processor: Dals Limited (formerly DA Languages)

Purpose: PCA uses NHSmail and Microsoft 365 applications for secure communication, storage and collaboration. This supports secure transfer of information between NHS organisations, protection against viruses and spam, and continuity of communication.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Processor: Accenture (NHSmail)Sub-processor: Microsoft

Purpose: Where you raise a concern or complaint, or where a patient safety incident occurs, we process the information necessary to investigate it, respond to you, and learn from it. Where an incident is reportable, information may be shared with the commissioner, the CQC, or the national Learn from Patient Safety Events service.Legal basis: Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest; andArticle 9(2)(h): processing is necessary for the provision of health care and the management of health care systems and services, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018Where a legal claim arises, Article 9(2)(f) applies: establishment, exercise or defence of legal claims. Processor: Hiscox (federation indemnity insurance), and their legal advisers where a claim arises

Purpose: We use the TVS Care Records to create, update and share ReSPECT (Recommended Summary Plan for Emergency Care and Treatment) forms. This helps health and social care professionals involved in your care understand your wishes and provide safe and appropriate treatment.  Legal Basis:Article 6(1)e“processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”;Article 9(2)h“processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services”;Processor Joint Controller: For ReSPECT forms recorded within TVS Care Records, The Primary Care Alliance CIC and Frimley Health NHS Foundation Trust act as Joint Controllers, meaning we work together to decide how this information is used.The TVS Care Records system is provided and hosted by:Graphnet Health LtdMicrosoft Azure These organisations act as Data Processors and process information on behalf of the Joint Controllers.